OWASP Top 10 Fixes for .NET Web APIs You Can Ship This Week

Security debt is still debt—here is a one-week sprint

Security audits often arrive as hundred-page PDFs while your backlog is full of features. The OWASP Top 10 is not a certification checklist; it is a prioritization lens for the vulnerabilities that actually appear in breached .NET APIs. This guide maps each category to concrete ASP.NET Core changes you can merge this week, with code patterns and verification commands—not vague "follow best practices" advice.

Assume you run ASP.NET Core 8 minimal APIs or controllers behind HTTPS in production. Adjust namespaces to your project.

A01 Broken Access Control

Problem: Users change IDs in URLs and access other tenants' orders or grades.

Fix: Authorization policies on every endpoint; never trust client-supplied tenantId without matching the authenticated principal.

[Authorize(Policy = "CanViewCourse")]
app.MapGet("/courses/{courseId}/grades", async (Guid courseId, ClaimsPrincipal user, ICourseAuthz authz) =>
{
    if (!await authz.UserCanViewCourseAsync(user.GetUserId(), courseId))
        return Results.Forbid();
    // ...
});

Enable global authorization fallback. Add integration tests that prove user A cannot read user B's resource IDs.

A02 Cryptographic Failures

Store passwords with ASP.NET Core Identity's PBKDF2 or Argon2 where available. TLS 1.2+ only at the load balancer. Disable legacy cookies without Secure and HttpOnly. Move encryption keys to Azure Key Vault; rotate on schedule. Never log JWTs or payment payloads.

A03 Injection

Parameterized queries via EF Core and Dapper—always. For dynamic sorting, whitelist columns:

var allowed = new HashSet<string> { "Title", "CreatedAt" };
if (!allowed.Contains(sortBy)) sortBy = "CreatedAt";
// Use EF.Property or raw SQL with parameters, never string concat

Validate file uploads: extension allowlist, max size, scan with Defender if storing on blob. LDAP and XML injection matter if you integrate legacy HR systems—disable DTDs in XmlReader.

A04 Insecure Design

Threat model one critical flow: password reset, coupon redemption, or certificate download. Add rate limits per IP and per account. Use single-use tokens with short TTL. For LMS products, prevent learners from marking completion without server-side progress validation—client-side only checks are design flaws, not bugs.

A05 Security Misconfiguration

// Program.cs essentials
if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}
app.UseHttpsRedirection();
app.Use(async (ctx, next) =>
{
    ctx.Response.Headers["X-Content-Type-Options"] = "nosniff";
    ctx.Response.Headers["X-Frame-Options"] = "DENY";
    ctx.Response.Headers["Referrer-Policy"] = "strict-origin-when-cross-origin";
    await next();
});
builder.Services.AddHsts(o => o.MaxAge = TimeSpan.FromDays(365));

Disable detailed exception pages in production. Remove default swagger exposure on public internet—protect with auth or VPN.

A06 Vulnerable and Outdated Components

Run weekly:

dotnet list package --vulnerable
dotnet list package --outdated

Pin versions in CI; fail builds on critical CVEs using OWASP Dependency-Check or GitHub Dependabot alerts. Container base images need the same discipline.

A07 Identification and Authentication Failures

Use built-in Identity or a proven IdP (Azure AD B2C, Auth0). Enforce MFA for admins. Short-lived access tokens, refresh token rotation, revoke on password change. Lockout after failed attempts. Do not implement crypto yourself.

A08 Software and Data Integrity Failures

Sign webhooks from Stripe or Cashfree; verify HMAC before updating order state. Protect CI/CD: branch protection, required reviews, OIDC to Azure instead of long-lived cloud secrets in GitHub.

A09 Security Logging and Monitoring Failures

Log authentication failures, authorization denials, admin actions, and validation errors at Warning without PII. Ship logs to SIEM or Azure Monitor. Alert on spike in 401/403 from single IP. Correlate with WAF logs if available.

A10 Server-Side Request Forgery (SSRF)

If your API fetches user-supplied URLs (webhook testers, "import from link"), block private IP ranges and metadata endpoints (169.254.169.254). Use an allowlist of domains or a dedicated egress proxy.

public bool IsSafeUrl(Uri uri)
{
    if (uri.Scheme != "https") return false;
    var host = uri.DnsSafeHost;
    if (IPAddress.TryParse(host, out var ip))
        return !IsPrivate(ip);
    // resolve and check — or deny by default
    return AllowedHosts.Contains(host);
}

Cross-cutting: CORS and mass assignment

CORS is not auth—restrict origins in production. Use record DTOs for input; never bind directly to EF entities. [JsonIgnore] on sensitive fields is insufficient; explicit create/update models win.

AI-specific risks in 2025 APIs

Prompt injection via support tickets processed by LLM tools can leak data if the model has SQL plugins. Treat AI agents like users with least privilege: read-only DB roles, no arbitrary HTTP from tool calls without allowlists, and human review for destructive actions. Log prompts and responses with redaction policies.

Verification checklist before Friday deploy

• Run OWASP ZAP baseline scan against staging.
• Confirm all endpoints require auth except explicit anonymous list.
• Attempt IDOR with two test accounts—automate in integration tests.
• Review appsettings committed history for secrets; rotate if found.
• Ensure Kestrel behind reverse proxy honors X-Forwarded-For only from trusted proxies.

You will not eliminate risk in a week, but shipping these OWASP-aligned fixes on .NET Web APIs closes the doors attackers actually try first. Schedule the harder work—formal pen tests, bug bounty, zero trust networking—after you stop the obvious misses.